[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160104074208.GA2016@debian>
Date: Mon, 4 Jan 2016 08:42:09 +0100
From: Markus Wichmann <nullplan@....net>
To: musl@...ts.openwall.com
Subject: Re: [PATCH] fix use of pointer after free in unsetenv
On Mon, Jan 04, 2016 at 02:09:44AM +0300, Alexander Cherepanov wrote:
> Hi!
>
> The code in [1] uses a pointer which was freed and hence has an
> indeterminate value. Patch attached.
>
> [1] http://git.musl-libc.org/cgit/musl/tree/src/env/unsetenv.c#n23
>
What are you talking about? free() ends the lifetime of the object
pointed to by the argument given. However, after the free() only the
pointer itself is used. It won't be dereferenced again, and instead will
be immediately overwritten with a valid pointer. And while it is
possible that the pointer becomes so invalid that even loading it causes
undefined behavior, this doesn't happen on any of the supported systems
(it might happen on i386 with segmentation, but Linux/i386, which is the
only supported OS for musl, doesn't use segmentation).
So it looks like unnecessary complexity to me to apply this patch.
Ciao,
Markus
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
